CVE-2008-6707

CWE-287 — Improper Authentication3 documents3 sources
Severity
6.4MEDIUM
EPSS
0.4%
top 38.33%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Avaya Communication ManagerAvaya SIP Enablement Services
Timeline
PublishedApr 10
Latest updateMay 17

Description

The Web management interface in Avaya SIP Enablement Services (SES) 3.x and 4.0, as used with Avaya Communication Manager 3.1.x, does not perform authentication for certain functionality, which allows remote attackers to obtain sensitive information and access restricted functionality via (1) the certificate installation utility, (2) unspecified scripts in the objects folder, (3) an "unnecessary default application," (4) unspecified scripts in the states folder, (5) an unspecified "default appli…

CVSS vector

AV:N/AC:L/C:P/I:P/A:NExploitability: 10.0 | Impact: 4.9

Affected Packages2 packages

▶NVDavaya/communication_manager6 versions+5

🔴Vulnerability Details

2
GHSA
GHSA-xq3v-rpgq-hxm8: The Web management interface in Avaya SIP Enablement Services (SES) 3↗2022-05-17
▶
CVEList
CVE-2008-6707: The Web management interface in Avaya SIP Enablement Services (SES) 3↗2009-04-10
▶